Internal control and deontology - Chapter 3 Control activities презентация

1. Segregation of duties
1.1. What is ‘segregation of duties’?
Segregation of duties (SoD) is an internal control designed to prevent error and fraud by ensuring that at least two individuals are responsible for the separate parts of any task.
SoD involves breaking down tasks that might reasonably be completed by a single individual into multiple tasks so that no one person is solely in control.
Internal control Chapter 3: Control activities

1. Segregation of duties
Authorization: authorizes activities and makes decisions
Custody of assets: maintians custody of assets (goods, money, data, …). Can only accept assets or release assets after approval by the authorizing function. Should deliver information to the record keeping function.
Record keeping: registrates/records all the activities taking place, independent from the persons authorizing and keeping custody
Reconciliation: checks the validity and completeness of the assignment given and reconciliate to check whether the execution was done right
Internal control Chapter 3: Control activities

1. Segregation of duties
Payroll management, for example, is an administrative area in which both fraud and error are risks. A common segregation of duties for payroll is to have one employee responsible for the accounting portion of the job and someone else responsible for signing the checks.
Although it improves security, breaking tasks down into separate components can negatively impact business efficiency and increase costs, complexity and staffing requirements. For that reason, most organizations apply SoD to only the most vulnerable and the most mission critical elements of the business.
Internal control Chapter 3: Control activities

1. Segregation of duties
1.2. Examples
payroll
purchasing
IT-development
Creation of computer ID’s
…
1.3. More than one function per person - collusion
1.4. Role analysis
Internal control Chapter 3: Control activities

2. Correct authorising and delegating
Authorisation = approval given by management to collaborators to perform certain activities or make certain decisions
2.1. Job descriptions
Clear and detailed description of all relative permanent aspects of a job/position/function and the responsabilities attached to this function
Useful for: selection procedure, organisation of work, salary management, evaluation process, …
Internal control Chapter 3: Control activities

2. Correct authorising and delegating
2.2. Rules for delegations/approval levels
Why?
Delegator can perform other tasks
Developing competences and motivation of employees
Decisions are being made on the correct level
Rise of efficiency and effectiveness of business processes
What?
? Management responsability is not being transfered! – operational responsability is being transfered ? control (by mgmt) is necessary!
Internal control Chapter 3: Control activities

3. Use of documents/forms
3.1. Basic requirements for documents
Fixed lay-out – pre-printed
Different colours for different recipients
Pre-numbered (to be able to check completeness)
3.2. Signature policy
Proof of intervention – proof of check being done
Extent can differ
Should be taken into consideration when designing documents
Internal control Chapter 3: Control activities

4. Safeguarding assets and information
4.1. Access Security
Physical access security
Electronical access security
Passwords (properties)
Logging
Firewalls and security software
Access policy and procedures should comply with SoD
4.2. Securing stock and data
Wharehouse
Electronic data
4.3. Registration of assets
Registration number in inventory list
Internal control Chapter 3: Control activities